Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
37 lines
1.4 KiB
Python
37 lines
1.4 KiB
Python
# -*- coding: utf-8 -*-
|
|
import os, re, sys
|
|
|
|
def extract_strings(data, min_len=5):
|
|
out = set()
|
|
for m in re.finditer(rb'[\x20-\x7e]{' + str(min_len).encode() + rb',}', data):
|
|
out.add(m.group().decode('ascii', 'ignore'))
|
|
return out
|
|
|
|
def scan_app(app_dir, filters):
|
|
strings = set()
|
|
for name in os.listdir(app_dir):
|
|
if not name.endswith('.dex'):
|
|
continue
|
|
with open(os.path.join(app_dir, name), 'rb') as f:
|
|
strings |= extract_strings(f.read())
|
|
print('\n===', os.path.basename(app_dir), '===')
|
|
for label, rx in filters:
|
|
matched = sorted({s for s in strings if re.search(rx, s, re.I)})
|
|
print('\n[%s] count=%d' % (label, len(matched)))
|
|
for s in matched[:50]:
|
|
print(' ', s)
|
|
|
|
filters = [
|
|
('up notifications', r'au\.com\.up\.money\.notifications|Lau/com/up/money/notifications'),
|
|
('suncorp messaging', r'au\.com\.suncorp\.marketplace.*(Messaging|Firebase|Notification|Push)'),
|
|
('ubank messaging', r'au\.com\.bank86400|bank86400|86400.*(Messaging|Firebase|Notification|Push|MoEngage)'),
|
|
('ubank onMessage', r'onMessageReceived|Will try to show push|MoEngage'),
|
|
('custom FCM services', r'MessagingService;|HandlerService|FirebaseService'),
|
|
]
|
|
|
|
root = sys.argv[1]
|
|
for app in sorted(os.listdir(root)):
|
|
p = os.path.join(root, app)
|
|
if os.path.isdir(p):
|
|
scan_app(p, filters)
|